30. (New) An apparatus for analyzing network activity, the apparatus comprising: 
a packet capturing module, for accessing the packets traversing a network, the packets 

having source and destination addresses of network devices exclusive of the apparatus, and 
for filtering the packets to produce packet data, wherein the packet capturing module 
produces the packet data by accessing a predetermined address, comparing the predetermined 
address to the source and destination addresses for a current packet, and retaining the current 
packet when one of the source and destination addresses for the current packet matches the 
predetermined address; 

a packet analyzing module, in communication with the packet capturing module, for 
producing decoded packet data and for producing transaction data from the decoded packet 
data; and 

a data management module, in communication with the packet capturing module and 
the packet analyzing module, for analyzing at least one of the packet data and the transaction 
data to provide an indication of network usage. 

3 1 . (New) An apparatus for analyzing network activity, the apparatus comprising: 
a packet capturing module, for accessing the packets traversing a network, the packets 

having source and destination addresses of network devices exclusive of the apparatus, and 
for filtering the packets to produce packet data, wherein the packet capturing module 
produces the packet data by retrieving a predetermined port address, comparing the 
predetermined port address to a source port address for a current packet, comparing the 
predetermined port address to a destination port address for the current packet, and retaining 



the current packet when one of the source and destination port addresses for the current 
packet matches the predetermined port address; 

a packet analyzing module, in communication with the packet capturing module, for 
producing decoded packet data, wherein the decoded packet data includes a plurality of 
patterns of packets, and for producing transaction data from the decoded packet data, 
wherein the transaction data is derived from a time value for identifying a substantially optimal 
collection of patterns of packets indicative of transaction occurrences; and 

a data management module, in communication with the packet capturing module and 
the packet analyzing module, for analyzing the packet data and the transaction data to provide 
an indication of network usage. 

32. (New) An apparatus for analyzing network activity, the apparatus comprising: 
a packet capturing module, for accessing the packets traversing a network, the packets 
having source and destination addresses other than an address corresponding to the apparatus, 
and for filtering the packets to produce raw packet data, wherein the packet capturing module 
produces the raw packet data by accessing a predetermined port address, comparing the 
predetermined port address to a source port address for a current packet, comparing the 
predetermined port address to a destination port address for the current packet, and retaining 
the current packet when one of the source and destination port addresses for the current 
packet matches the predetermined port address; 



a packet analyzing module, in communication with the packet capturing module, for 
produtitig decoded packet data and for producing transaction data from the decoded packet 

data; and 

* V - - 

a dat^ jnanagement module, in communication with the packet capturing module and 

. 

the packet Analyzing module, for analyzing at least one of the raw packet data, the decoded 
•*v\ . 

pack^data, an d^ ae transaction data to provide an indication of network usage. 

33. (New) An apparatus for analyzing /etwork activity, the apparatus 
comprising: 

a packet capturing module, for accessing a plurality of packets traversing a network, 
the packets having source and destination addresses of network devices exclusive of the 
apparatus, and for filtering the packetSvto produce packet data; 

a packet analyzing module , inlcon^imication with the packet capturing module, for 
producing decoded packet data and f^pBraucing transaction data from the decoded packet 
data, the packet decoding module comcpsing (/) and (b) following: 

(a) a packet decoder, foriccessmg the packet data and producing the decoded 
packet data by searching in text P ac ^ et ^ ata f° r one or more key words; and 

(b) a decoded packe^ecompiler, in communication with the packet decoder, for 
accessing the decoded packet data, segregating the packets from the decoded packet data into 

7/ 

separate transactions between nodes by ordering according to thread and a time interval, 

i 

sequencing the packets corresponding to each separate transaction by identifying a packet 

if 

position in a pattern corresponding to each separate transaction, and linking together the data 



in each separate transaction when the identified positions ajre determined to produce the 
transaction data, \vherein the transaction data is derived from a time value and identifies a 

- > j. 

collection of the patterns of packets that is substantially/optimal for identifying transaction 
instances; and 

a data management module, in cdmmunicatiomwith the packet capturing module and 

/ ' 

the packet analyzing module, for analyzing the packptf data and the transaction data to provide 
an indication of network usage. 



34. (New) An apparatus for analyzing network activity, the apparatus 



comprising; 



a packet capturing module, foV &ce|sing packets traversing a network^the packets 
having source and destination addressesVflipetwork nevices exclusive of the apparatus, and 
for filtering the packets to produce packet a^t; 

a packet analyzing module , in ^Wut^cation with the packet capturing module, for 
producing decoded packet data and fqf producing transaction data from the decoded packet 



data, the packet analyzing module ^mprisitig: ' 

a packet decoder, for accessing the packet data and producing the decoded packet 

. 7/ 

data; and 

a decoded packet recqftipiler, In communication with the packet decoder, for 

/*.-.* 

7 

accessing the decoded packet data, segregating the packets from the decoded packet data into 
separate transactions betweeiynodes, sequencing the packets corresponding to each separate 



transaction, and linking together the data in each separate transaction to produce the 
transaction data; and / *j 

a data management mocj^e, iiyc^munication with the packet capturing module and 
the packet analyzing module, ioti^^m^t least one of the packet data and the transaction 
data to provide an indication^^^etwork'usage. 

35. (New) For use with a network activity analyzer capable of being coupled 
to a network transmission medium, a method of analyzing network activity, the method 
comprising: 

accessing packets traversing the network, the packets having source and destination 
addresses of network devices exclusive of the network activity analyzer; 

filtering the packets to produce packet data by (a) through (c) following: 

(a) accessing a predetermined address; 

(b) comparing the predetermined address to the source and destination 
addresses for a current packet; and 

(c) retaining the current packet when one of the source and destination 
addresses for the current packet matches the predetermined address; 

producing decoded packet data, wherein the decoded packet data includes a plurality 
of patterns of packets; 

producing transaction data from the decoded packet data, wherein the transaction data 
is derived from a time value and identifies a substantially optimal collection of patterns of 
packets indicative of transaction instances; and 



analyzing the packet data and the transaction data to provide an indication of network 

usage. 

36. (New) For use with a network activity analyzer capable of being coupled 
to a network transmission medium, a method of analyzing network activity, the method 
comprising: ' 

accessing packets traversing the network, the packets having source and destination 
addresses of network devices exclusive of the network activity analyzer; 

filtering the packets to produce raw packet data by (a) through (c) following: 

(a) accessing a predetermined address; 

(b) comparing the predetermined address to the source and destination 
addresses for a current packet; and 

(c) retaining the current packet when one of the source and destination 
addresses for the current packet matches the predetermined address; 

producing decoded packet data; 

producing transaction data from the decoded packet data; and 
analyzing the decoded packet data and the transaction data to provide an indication 
of network usage. 



37. (New) For use with a network activity analyzer capable of being coupled 
to a network transmission medium, a method of analyzing network activity, the method 
comprising: 

8 



accessing packets traversing the network, the packets having source and destination 
addresses of network devices exclusive of the network activity analyzer; 

filtering the packets to produce packet data by: (a) accessing a predetermined port 
address; (b) comparing the predetermined port address to source and destination port 
addresses for a current packet; and (c) retaining the current packet when one of the source 
and destination port addresses for the current packet matches the predetermined port address; 

producing decoded packet data, wherein the decoded packet data includes a plurality 
of patterns of packets; 

producing transaction data from the decoded packet data, wherein the transaction data 
is derived from a time value for identifying a substantially optimal collection of patterns of 
packets indicative of transaction occurrences; and 

analyzing the packet data and the transaction data to provide an indication of network 

usage. 

38. (New) For use with a network activity analyzer capable of being coupled 
to a network transmission medium, a method of analyzing network activity, the method 
comprising: 

accessing packets traversing the network, the packets having source and destination 
addresses of network devices other than an address corresponding to the network activity 
analyzer; 

filtering the packets to produce raw packet data by: accessing a predetermined port 
address; comparing the predetermined port address to source and destination port addresses 



for a current packet; and retaining the current packet when one of the source and destination 
port addresses for the current packet matches the predetermined port address; 

producing decoded packet data?** 

producing transaction data from the decoded packet data; and 

re- 
analyzing at least one of the decoded packet data and the transaction data to provide 

an indication of network usage. 



39. (New) For use with a network activity analyzer capable of being coupled to 
a network transmission medium, a method of $nalyzdng network activity, the method 



comprising: 



accessing packets traversing the network, ttfe ^packets Jiaving source and destination 
addresses of network devices exclusive of the network activity analyzer; 

,7 • \ r % - 

filtering the packets to produce packey data; • v . 



se/n 



producing decoded packet data^y serening in text of the placket data for one or more 
key words; 

producing transaction data from^efdecocjfed packet data by (a) accessing the decoded 

packet data; (b) segregating the pac^t^from the decoded packet data into separate 

transactions between nodes of the network by ordering acc&ifdirig to thread and a time 

interval; (c) sequencing the packets corresponding to eich separate transaction by identifying 

$1 



a packet position in a pattern corr 



jponding to each separate transaction; and (d) linking 



together the data in each separate tr msaction when the identified positions are determined to 

•/ / ■ " 

produce the transaction data, ,whei ;in the transaction data is derived from a time value and 
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identifies a collection of the patterns that is substantially cjptimal for identifying transaction 
instances; and 

analyzing the packet data and the transa^on dafa to provide an indication of network 

usage. 




40. (New) For use with a network activity analyzer capable of being coupled to 



a network transmission medium, a method |>f analyzing network activity, the method 



composing: 



accessing packets traversing the network, the packets having source and destination 



addresses other than an address/corresponding to the network activity analyzer; 
filtering the packets to^roduee^aw packet data; 

t/l/ / 

producing decpdep packet data; 

producing trarfsafiMon Hata from the decoded packet data by accessing the decoded 
packet data; segregating/ther packets from the decoded packet data into separate transactions 
between nodes of thef network? sequencing the packets corresponding to each separate 



transaction; and linlpng together the data in each separate transaction to produce the 



# 



transaction data; arid . / 



analyzing/at least one of the raw packet data, the decoded packet data, and the 

. ./..'-. v 

transaction data to provide an.iridication of network usage. 
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4 1 . (New) For use with a network activity analyzer capable of being coupled to 

* • / 

a network transmission medium, a method of analysing network activity, the method 



comprising; 

accessing packets traversing the network^the packets having source and destination 

r / 

addresses of devices exclusive of the activity ihalyzer; 
filtering the packets to produce pac/ket data; 

producing decoded packet data ^searching in text of the packet data for one or more 
key words; 

producing transaction data fi£m the decoded packet data by accessing the decoded 
1 0 packet data; segregating the packe#s.ff om the decoded packet data into separate transactions 
between nodes by ordering acdOTdi^'folhread and a time interval; sequencing the packets 
corresponding to each separat(^rtos^aion by identifying a:packet position in a pattern 
corresponding to each separate transaction; and linking together the data in each separate 



transaction when the identified positions are determined to produce the transaction data, 



15 wherein the transaction c$ta is derived from a time value and identifies a collection of the 

I 

patterns that is substantially optimal for identifying transaction instances; and 



producingftransflated transaction data from the transaction data wherein the translated 



20 fusage 



transaction da^inclu/les response data aggregated according to a fixed time interval; and 
analyzing thefpacket data and the transaction data to provide an indication of network 

7 
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42. (New) For use with a network activity ajplyzer capable of being coupled to 
a network transmission medium, a method or analyzing network activity, the method 
comprising; 

:/r // 

accessing packets traversing the network, the packfcfS'having source and destination 
addresses of devices exclusive of the activihpnaly£er; 
filtering the packets to pr^duce^^cket data; 




producing decoded packet\u^ay ^ 
producing tfansactiom^ataj^M^the de^de^packet data by accessing the decoded 
packet data; segregating the packofs from^Ke decoded packfet data into separate transactions 
between hoa6s; seqyentirig#har packets corresponding to each separate transaction; and 



linking togetherlhe data4h ejfch separate transaction; 

producing translates transaction data from the transaction data; and 



analyzing the packet data and the transaction data to provide an indication of network 

sage. 

43 . i*j (New) An apparatus for analyzing network activity, the apparatus comprising: 
means for accessing packets traversing the network, the packets having source and 

destination addresses of devices exclusive of the network activity analyzer; 

means for filtering the packets to producepacket data, wherein the means for filtering 

the packets to produce packet data includes routines for retrieving a predetermined address; 

comparing the predetermined address to the source and destination addresses for a current 
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packet; and retaining the current packet when one of the source and destination addresses for 
the current packet matches the predetermined address; 

means for producing decoded packet data, wherein the decoded packet data includes 
a plurality of patterns of packets; 

means for producing transaction data from the decoded packet data, wherein the 
transaction data is derived from a time value for identifying a substantially optimal collection 
of patterns of packets indicative of transaction instances; and 

means for analyzing the packet data and the transaction data to provide an indication 
of network usage. 

44. (New) An apparatus for analyzing network activity, the apparatus comprising: 

means for accessing packets traversing the network, the packets having source and 
destination addresses of devices exclusive of the network activity analyzer; 

means for filtering the packets to produce packet data, wherein the means for filtering 
the packets to produce packet data includes routines for retrieving a predetermined address; 
comparing the predetermined address to the source and destination addresses for a current 
packet; and retaining the current packet when one of the source and destination addresses for 
the current packet matches the predetermined address; 

means for producing decoded packet data; 

means for producing transaction data from the decoded packet data; and 
means for analyzing the packet data and the transaction data to provide an indication 
of network usage. 

14 
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45 . (New) An apparatus for analyzing network activity, the apparatus comprising: 
means for accessing packets traversing the network, the packets having source and 

destination addresses for network devices exclusive of the network activity analyzer; 

means for filtering the packets to produce packet data, wherein the means for filtering 
the packets to produce packet data includes routines for accessing a predetermined port 
address; comparing the predetermined port address to a source port address for a current 
packet; comparing the predetermined port address to a destination port address for the 
current packet; and retaining the current packet when one of the source and destination port 
addresses for the current packet matches the predetermined port address; 

means for producing decoded packet data, wherein the decoded packet data includes 
a plurality of patterns of packets; 

means for producing transaction data from the decoded packet data, wherein the 
transaction data is derived from a time value for identifying a substantially optimal collection 
of packets indicative of transaction occurrences; and 

means for analyzing the packet data and the transaction data to provide an indication 
of network usage. 

46. (New) An apparatus for analyzing network activity, the apparatus comprising: 
means for accessing packets traversing the network, the packets having source and 

destination addresses for network devices other than an address corresponding to the network 
activity analyzer; 
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means for filtering the packets to produce raw packet data, wherein the means for 
filtering the packets to produce raw packet data includes routines for retrieving a 
predetermined port address; comparing the predetermined port address to a source port 
address for a current packet; comparing the predetermined port address to a destination port 
address for the current packet; and retaining the current packet when one of the source and 
destination port addresses for the current packet matches the predetermined port address; 

means for producing decoded packet data; 

means for producing transaction data from the decoded packet data; and 
means for analyzing at least one of the decoded packet data and the transaction data 
to provide an indication of network usage. 

47. (New) An apparatus for analyzing network activity, the apparatus comprising; 

means for accessing packets traversing the network, the packets having source and 

> / 

destination addresses other than an acjdrSss corresponding to the network activity analyzer; 

>* I 

\ to projiuGe packet data; 
metans for producing decoded ggcket daja by searching in text of the packet data for 
one or more key words; 

means for producing trap action data from the decoded packet data, wherein the 
means for producing transaction data includes routines for accessing the decoded packet data; 

segregating the packets #om the decoded packet data into separate transactions between 

if 

nodes by ordering according to thread and a time interval; sequencing the packets 

// 

corresponding to e^ch separate transaction by identifying a packet position in a pattern 

16 



means for filtering the packet 
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corresponding to each separate transaction; and linking together the data in each separate 
transaction when the identifi^ positions gre determine to produce the transaction data, 

wherein the transaction data is derived from a time and identifies a collection of the 

.1 

15 patterns that is substantially optimal for identifying jf ansaction instances; and 

means for analyzing the packet data and thf transaction data to provide an indication 
of network usage. 



f iff ' 

(New) An apparatus for analyzing network activity, the apparatus comprising; 

f " 

means for accessing packets tr^ei/sjngjh^ network, the packets having source and 
destination addresses other thariSan addres^orrejponding to the network activity analyzer; 



- rii&tns for filtering the pacKets/o produce raw packet data; 

•• , ' ■ - - ^ '. : / ■ .;:// ■ 

5' • means for producing d€co$tp packet data; 

means for producing transaction data from the decoded packet data, wherein the 
means for producing transactionmta includes routines for accessing the decoded packet data; 
segregating the packets frornythe decoded packet data into separate transactions between 

... . -v, * f ■ ■ . > ■ ■ 

nodes; sequencing ^he pacKets corresponding to each separate transaction; and linking 



10 together the data in t$bh separate transaction to produce the transaction data; and 

means for andyzjhg jjjie decoded packet data and the transaction data to provide an 
indication of netwprlc uj|ajjge . \ . 



REMARKS 

.^laimis 29 through 48 are substantially copied from U.S. Patent No. 5,787,253 
granted July 28, 1998 16 McCreery, etal. and assigned to the A. G. Group in accordance with 
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